Vhiki rimwe nerimwe, masisitimu edu ekuona malware anoskena zviuru zvemapakeji matsva uye akagadziridzwa mumarejista everuzhinji akadai se npm nePyPI.
Vhiki rino raive rakabatikana zvikuru.
Takasimbisa Mapakeji ane njodzi zana nemakumi matatu nemashanu, kunyanya mhiri npm, nedzimwe nyaya dziri mu OpenVSX. Dzakawanda dzakaonekwa mumaboka akarongeka, nekuburitswa kwakashata kakawanda kwakabudiswa nemazita akafanana kana mumhuri dzemapakeji dzine hukama hwepedyo. maSDK ekubhadhara, enterprise tooling, zvishandiso zvevagadziri, Kuwedzerwa kweOpenVSX, Mapakeji ane dingindira reAI uye reagent, zvikamu zvekusvikika, Vabatsiri veUI, nedzimwe modules dzinowanzo shandiswa mumabasa ekuvandudza emazuva ano.
Izvi zvakanga zvisiri zvinhu zvisina kujairika. Chakanyanya kuoneka vhiki rino kwaive kuburitswa kwakawanda mumapakeji akafanana, kushandiswazve kwemazita emazita, uye nzira iyo mapakeji ane njodzi aionekwa seakavimbika mukati mekutumira software chaiyo. pipelines.
Mufananidzo uyu wevhiki nevhiki chikamu chedu chinoenderera mberi Kuongororwa kweMakodhi Akaipa, patinosimbisa njodzi itsva uye kupa hungwaru hunogona kushandiswa kubatsira Zvikwata zveDevSecOps chengetedza yavo pipelines usati wakuvara.
Ngatitsanangure zvatakawana vhiki rino uye kuti nei zvichikosha.
| Ecosystem | nhuri | zuva |
|---|---|---|
| npm | admin0911:1.0.23 | Apr 14, 2026 |
| npm | admin0911:1.0.47 | Apr 14, 2026 |
| npm | admin0911:1.0.59 | Apr 14, 2026 |
| npm | @searchos/bot-proxy:0.1.4 | Apr 10, 2026 |
| npm | baidu-ti:1.0.0 | Apr 10, 2026 |
| vhuravsx | rajdeepchandra/spectrum-design-token-for-vscode:0.0.1 | Apr 11, 2026 |
| vhuravsx | rajdeepchandra/spectrum-design-token-for-vscode:0.0.3 | Apr 11, 2026 |
| vhuravsx | rajdeepchandra/spectrum-design-token-for-vscode:0.0.4 | Apr 11, 2026 |
| npm | @genoma-ui/zvikamu:99.99.2 | Apr 11, 2026 |
| npm | kubhadhara-kubhadhara-sdk-zvakajairika:99.0.0 | Apr 13, 2026 |
| npm | kubhadhara-kadhi-rekubhadhara: 99.0.0 | Apr 13, 2026 |
| npm | paysafe-google-pay:99.0.0 | Apr 13, 2026 |
| npm | paysafe-apple-pay:99.0.0 | Apr 13, 2026 |
| npm | paysafe-venmo:99.0.0 | Apr 13, 2026 |
| npm | kubhadhara-kadhi-rekubhadhara: 99.99.1 | Apr 13, 2026 |
| npm | kubhadhara-kubhadhara-sdk-zvakajairika:99.99.1 | Apr 13, 2026 |
| npm | paysafe-google-pay:99.99.1 | Apr 13, 2026 |
| npm | paysafe-venmo:99.99.1 | Apr 13, 2026 |
| npm | unisys-core:99.99.1 | Apr 11, 2026 |
| npm | unisys-auth:99.99.1 | Apr 11, 2026 |
| npm | unisys-sdk:99.99.1 | Apr 11, 2026 |
| npm | nzvimbo yekutambira yeunisys-agent-ai:99.99.2 | Apr 11, 2026 |
| npm | unisys-auth:99.99.2 | Apr 11, 2026 |
| npm | unisys-sdk:99.99.2 | Apr 11, 2026 |
| npm | sysverify-core: 1.0.0 | Apr 13, 2026 |
| npm | kutsvaga-sefa-mugamuchiri:1.0.0 | Apr 13, 2026 |
| npm | magentaa11y:9.9.11 | Apr 14, 2026 |
| npm | magentaa11y:9.9.12 | Apr 14, 2026 |
| npm | mushandisi webitu:99.0.0 | Apr 13, 2026 |
| npm | bitu-app:99.0.0 | Apr 13, 2026 |
| npm | rn-bitu:99.0.0 | Apr 13, 2026 |
| npm | bitu-core:99.0.0 | Apr 13, 2026 |
| npm | bitu-protocol:99.0.0 | Apr 13, 2026 |
| npm | kubi-staking:99.0.0 | Apr 13, 2026 |
| npm | bitu-kutengeserana:99.0.0 | Apr 13, 2026 |
| npm | bitu-wallet:99.0.0 | Apr 13, 2026 |
| npm | bitu-sdk:99.0.0 | Apr 13, 2026 |
| npm | @gbrlxvii/ts-form-utils:1.0.2 | Apr 13, 2026 |
| npm | @gbrlxvii/ts-form-utils:1.0.3 | Apr 13, 2026 |
| npm | kubi-staking:99.0.1 | Apr 13, 2026 |
| npm | magentaa11y:9.9.16 | Apr 14, 2026 |
| npm | magentaa11y:9.9.18 | Apr 14, 2026 |
| npm | stacks-editor: 9.9.9 | Apr 16, 2026 |
| npm | mutemo wekuchengetedza nekukurumidza: 1.0.2 | Apr 17, 2026 |
| npm | ixpresso-core:1.0.1 | Apr 16, 2026 |
| npm | ixpresso-core:1.0.2 | Apr 16, 2026 |
| npm | @athena-ui-components/deeplink:0.0.41 | Apr 16, 2026 |
| npm | @athena-ui-components/helpers:1.1.24 | Apr 16, 2026 |
| npm | @athena-ui-components/lang:0.1.18 | Apr 16, 2026 |
| npm | @athena-ui-components/layout:1.2.24 | Apr 16, 2026 |
| npm | kuonekwa kwechinhu-chitsvuku-chinopa-yolo-chinhu:9.1.11 | Apr 16, 2026 |
| npm | kuonekwa kwechinhu-chitsvuku-chinopa-yolo-chinhu:9.1.12 | Apr 16, 2026 |
| npm | mwedzi:1.0.7 | Apr 17, 2026 |
Chengetedza Kuvimba Kwako Nevashandisi Vasina Ruzivo uye Kusava Nekodzero Dzekuchengetedza Makombiyuta
Deredza njodzi uye chengetedza mapurogiramu ako kubva kumapakeji ane njodzi ane Kuonekwa Kwemarware EXygeni PakutangaIsa zvinhu zvinonyanya kukosha uye gadzirisa matambudziko anonyanya kukosha. Mhinduro yedu yakazara inopa kutarisa nguva chaiyo kwezvishandiso zvako kuti uone uye uderedze njodzi dzisati dzakanganisa software yako.
Kutarisira zvikamu zvemapurogiramu akavhurika munzvimbo iripo yekugadzira software kwakakosha nekuda kwekuwedzera kwekusagadzikana uye kutyisidzira kwekodhi yakaipa. Xygeni's Open Source Security Mhinduro inoongorora uye inovhara mapakeji ane njodzi kana yaburitswa, zvichideredza zvikuru njodzi yekuti malware nenjodzi zvipinde mumasisitimu ako. Kutarisa kwedu kwakazara kunosanganisira marejista eruzhinji akawanda, tichiona kuti zvese zvinoenderana nazvo zvinoongororwa kuti zvionekwe zvakanaka uye zvakavimbika. Xygeni inowedzera kugona kwechikwata chako kuchengetedza mapurojekiti esoftware akachengeteka uye akavimbika nekuisa zvinhu zvakakosha pakutanga uye kutungamira maitiro ekugadzirisa akareruka.
Xygeni inoshandisa nzira dzakasiyana-siyana kumisa kodhi yakaipa isati yapararira. Chekutanga, ongororo yekodhi isingachinji inoona maitiro ekuvhara, mitoro yakavanzwa, uye kushandiswa zvisina kunaka kwescript. Pamusoro pezvo, ongororo dzesandboxing dzinoitwa nemaitiro ekuita. hooks, mirairo yekumhanya, uye matipi ekutsungirira. Uyezve, kuona machine learning kunoratidza zero-day npm malware uye pypi malware variants zvisipo nema signature scanners. Pakupedzisira, Early Warning System inotarisa marepository everuzhinji munguva chaiyo, inosimbisa zvakawanikwa, uye inonyevera mapoka eDevOps ipapo ipapo.
Nekuda kweizvozvo, musanganiswa uyu unoita kuti vagadziri vagamuchire ruzivo rwakakurumidza uye runoshanda rwakabatanidzwa zvakananga mu CI/CD workflows.
Nei Vagadziri Vachifanira Kufarira Nezve Matambudziko eNpm
Zvinotyisa zvemazuva ano hazviwanzo mirira nguva yekumhanya. Semuenzaniso, mapakeji e-npm ane njodzi anowanzo shandiswa panguva yekuiswa, nepo mapakeji e-pypi ane njodzi achiviga kubuda kwematokeni kana masuo ekumashure. Varwi:
- Chinja ma reposi eGitHub akavanzika kuita eruzhinji kuti adzokorore.
- Budisa zvitupa nezvakavanzika uchishandisa zvinhu zvakanyoreswa.
- Shandisa maJavaScript loaders asina kujeka kuti uise ransomware kana botnets.
Kutaura zvazviri, mapakeji ekutsvaga ruzivo rwakapararira akawedzera ne156% mugore rimwe chete. Nokudaro, zvikwata zvinongovimba chete nema feeds akanonoka kana ma basic scanners zvinosara kumashure.
Zvinotevedzwa neMalware Report iyi muna npm nePyPI
Kuverenga uku ndiko musimboti we:
- Mapakeji eNpm ane hutsinye akasimbiswa
- Mapakeji ane njodzi ePypi akasimbiswa
- Kuonekwa kwekodhi ine njodzi kunoenderana nemaitiro
- Zviitiko zvakasimbiswa neRegistry
- Pfupiso yemishumo yemalware yevhiki nevhiki uye yemwedzi
- Nhoroondo yekuchinja kwezvese zvakawanikwa pa npm malware ne pypi malware
Nemamwe mashoko, inopa pfungwa imwe chete yekutarisa. Chikwata chekutsvagisa cheXygeni chinovandudza peji rino vhiki nevhiki nekubatanidza kune zvese zvekuongorora tekinoroji uye maGitHub IOC.
Maitiro Ekudzivirira Kubva kuMarware eNpm uye PyPI Malware
Nekuda kwengozi iyi iri kukura, masangano anoda dziviriro yakasimba:
- Simbisai kuiswa kwe lockfile chete (
npm ciin CI/CD. - Uyezve, tarisa zvinoenderana nekushandisa Xygeni's Early Warning Engine.
- Uyezve, block inovaka pazviratidzo zvekodhi yakaipa uchishandisa Guardrails.
- tanga SBOMs kutsvaga zvinhu zvisina kunanga uye kushandisa marongero.
- Pamusoro pezvose, dzidzisai vagadziri vemapurogiramu kuti vaone kunyorwa kwemashoko asina kunaka, kuvharika, uye magwaro ekuisa anofungirwa.
Edza maturusi ekuona mavhairasi eXygeni
Xygeni inopa:
- Kuwanikwa kwekodhi yakaipa panguva chaiyo, kusanganisira backdoors, spyware, uye ransomware.
- Kusiyana nema scanner ekutanga, ongororo mukati me npm, P&PI, Maven, NuGet, rubygems, Uye zvakawanda.
- Kuvharira kwekuvaka otomatiki kana mushumo we malware unoratidza njodzi.
- Ruzivo rwekushandiswa kwechinhu, kuongorora mukurumbira wemuchengeti, uye kuona zvinhu zvisina kujairika.
